Threats tagged 'ghsa-8c5q-hx4g-qq23'

LocalAI contains an unauthenticated server-side request forgery (SSRF) vulnerability in its POST /models/apply endpoint. Attackers can supply unsanitized gallery URL fields that are used without validation, causing the server to make HTTP GET requests to internal or private network addresses. This may expose partial response data through error messages. No affected versions or patches are currently specified.